How to create simple XML dashboard with contextual drilldown elements in Splunk 6?

[cphair]

Hi. I'm trying to create a simple XML dashboard with one table and a chart that takes a drilldown value from that table. http://docs.splunk.com/Documentation/Splunk/6.1.1/Viz/Understandbasictableandchartdrilldownactions describes what I want under "Contextual drilldown elements", but when I try to implement the drilldown as described in the first example, it simply takes me to the search bar when I click a table row. I looked at the Splunk 6 Dashboard Examples App, but the in-page drilldown with permalinking example requires CSS and JS, and it doesn't seem like that should be needed. Is there some parameter I'm missing that will tell it to stay on the current page and just load the extra chart?

EDIT: Here's the relevant code. I tried using click.value instead of row.site, but neither worked; nor did including the option for drilldown=row.

Test

-5m
now

index=foo sourcetype=iis-access | eval Error=if(code>=400,1,0) | stats count as Volume sum(Error) as Errors avg(time_taken) as AvgTime max(time_taken) as Max_Time by site | eval AvgTime=round(AvgTime,1)
$earliest$
$latest$

$row.site$

true
false
none
10




<![CDATA[index=foo sourcetype=iis-access site=$site$ | eval ServiceLevel=case(0<=time_taken AND time_taken <2,"good",2<=time_taken AND time_taken <4,"warning",4<=time_taken,"unacceptable",1==1,"error") | chart count by ServiceLevel]]>

[dmaislin_splunk · Accepted solution]

Full examples are in these apps. I recommend upgrading to the 6.1.1 release as well.

Splunk 6.1 Overview:
https://apps.splunk.com/app/1773/

Simple XML Examples>
https://apps.splunk.com/app/1603/

[cphair]

Thanks for the clarifications. Unfortunately this isn't an instance I have control over upgrading, so I'll write it off for now.

[nfilippi_splunk]

Correct, in-page drilldown is a new feature in Splunk 6.1, whereby you can fully configure it in Simple XML without the requirement for custom js and css.

After upgrading to Splunk 6.1, I would recommend installing the latest Splunk 6.x Dashboard Examples app v2.0.1 as that includes the updated Simple XML-only example.

[dmaislin_splunk]

I haven't tested without the javascript and css in 6.x. I just found it easier to upgrade. Sorry I can't be of more assistance.

[cphair]

So in-page drilldown isn't supposed to work in simple XML in 6.0 without all the extras?

[dmaislin_splunk]

In 6.0.x the CSS and JS is extra. In 6.1 it is no longer required.

[cphair]

Hi @dmaislin_splunk. I already looked at these apps and noted in my question that the in-page example in the app required JS and CSS, and the docs imply that shouldn't be necessary. Is the doc I linked incorrect, or did I miss something in the implementation?

[martin_mueller]

Do post the relevant SimpleXML code. There's nothing in particular to be careful about, so there's probably a simple mistake in there somewhere.